alma-appimage

maintainer dagmarbjorkman · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs an AppImage from a GitHub release URL, which is a prebuilt executable from a source that, while plausible, is not on a strict whitelist and has a recently orphaned and re-adopted status, increasing supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs an AppImage from a GitHub release URL, which is a prebuilt executable from a source that, while plausible, is not on a strict whitelist and has a recently orphaned and re-adopted status, increasing supply-chain risk.

PKGBUILD

      1# Maintainer: celeste <renzhewudi2013@outlook.com>
    
      2
    
      3pkgname=alma-appimage
    
      4_pkgname=alma
    
      5pkgver=0.0.241
    
      6pkgrel=1
    
      7pkgdesc="A beautiful desktop application that unifies your AI experience."
    
      8arch=('x86_64')
    
      9url="https://github.com/yetone/alma-releases"
    
      10license=('custom')
    
      11options=('!strip' '!debug')
    
      12depends=('fuse2')
    
      13source=("${_pkgname}-${pkgver}.AppImage::${url}/releases/download/v${pkgver}/alma-${pkgver}-linux-${arch}.AppImage"
    
      14  "${_pkgname}.desktop"
    
      15  "${_pkgname}.png"
    
      16  "${_pkgname}.sh")
    
      17noextract=("${_pkgname}-${pkgver}.AppImage")
    
      18conflicts=("${_pkgname}")
    
      19
    
      20package() {
    
      21  cd "$srcdir"
    
      22
    
      23  # Create directories
    
      24  install -dm755 "${pkgdir}/usr/share/applications"
    
      25  install -dm755 "${pkgdir}/usr/share/icons/hicolor/256x256/apps"
    
      26
    
      27  # Install AppImage
    
      28  install -Dm755 "${_pkgname}-${pkgver}.AppImage" "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
    
      29  # Install icon
    
      30  install -Dm644 "${_pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${_pkgname}.png"
    
      31  # Install desktop file
    
      32  install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      33  # Install alma
    
      34  install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      35}
    
      36sha256sums=('21c53e8edce28386974e390fdf5b7ed08383323016e71c6c8994413652c3032a'
    
      37            'cc72943eba33facd3e3a00f30ecac1753407255cef5e5ed508e3e9c6a8014ddc'
    
      38            '153b2379e92cf9e6f1158b5baf7d22102b100028e7e04c4ca79dd009a3e1dc00'
    
      39            'afb4bb27b8071b6de919ebcde97a1b4dd27fa1ae5451afe14e533e51e00bb402')
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0